The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a potential surface for indirect prompt injection by ingesting untrusted data through the 'customCopy' text and 'uploadedImages' file paths. This data is directly interpolated into CLI commands. The instructions lack specific boundary markers or sanitization steps to ensure the agent ignores malicious instructions embedded within these external inputs.\n
Ingestion points: 'customCopy' (text parameter up to 500 characters) and 'uploadedImages' (file paths/URLs) in the 'qhkit image generate' commands.\n
Capability inventory: The skill has capabilities to execute shell commands, perform network operations via the qhkit API, and write to the local file system.\n
Boundary markers: Absent.\n
Sanitization: No sanitization logic or instructions are provided to the agent.\n- [DYNAMIC_EXECUTION]: The skill provides pre-formatted shell command templates that invoke Python and Node.js at runtime to perform image compression (e.g., using 'python -c' to run Pillow code or 'npx' to execute 'sharp-cli'). While these are standard image processing operations, they involve the dynamic generation and execution of code based on local file paths.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'qhkit' CLI tool and the Node.js runtime environment. It provides instructions to download these resources from official and well-known services, including nodejs.org and the NPM registry. The skill correctly incorporates security best practices by instructing the agent to verify the SHA256 checksum of downloaded binaries before installation.\n- [COMMAND_EXECUTION]: The skill requires the agent to manage the local execution environment by running shell commands for package installation, directory management, and environment variable configuration. These commands are necessary for the skill's primary function and are documented as expected administrative operations.

linkpix-lazada-image